From 1d0bc315d5c9af662a78f12fc24f5b12b7728d11 Mon Sep 17 00:00:00 2001 From: Cristy Date: Sun, 24 Jan 2016 17:42:22 -0500 Subject: [PATCH] Fix out of bound for viff file Bug: https://github.com/ImageMagick/ImageMagick/issues/99 Origin: upstream, https://github.com/ImageMagick/ImageMagick/commit/ca0c886abd6d3ef335eb74150cd23b89ebd17135 bug-ubuntu: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1537425 bug-debian: https://bugs.debian.org/832483 --- coders/viff.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/coders/viff.c b/coders/viff.c index 54b898525..af6b4e334 100644 --- a/coders/viff.c +++ b/coders/viff.c @@ -65,6 +65,9 @@ #include "magick/static.h" #include "magick/string_.h" #include "magick/module.h" + +#define MagickMax(X,Y) ((X) > (Y) ? (X) : (Y)) + /* Forward declarations. @@ -496,8 +499,8 @@ static Image *ReadVIFFImage(const ImageInfo *image_info, max_packets=((image->columns+7UL) >> 3UL)*image->rows; else max_packets=(size_t) (number_pixels*viff_info.number_data_bands); - pixels=(unsigned char *) AcquireQuantumMemory(max_packets, - bytes_per_pixel*sizeof(*pixels)); + pixels=(unsigned char *) AcquireQuantumMemory(MagickMax(number_pixels, + max_packets),bytes_per_pixel*sizeof(*pixels)); if (pixels == (unsigned char *) NULL) ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); count=ReadBlob(image,bytes_per_pixel*max_packets,pixels);